<!doctype html>



  


<html class="theme-next mist use-motion" lang="zh-Hans">
<head>
  <meta charset="UTF-8"/>
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"/>



<meta http-equiv="Cache-Control" content="no-transform" />
<meta http-equiv="Cache-Control" content="no-siteapp" />












  
  
  <link href="/lib/fancybox/source/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css" />




  
  
  
  

  
    
    
  

  

  

  

  

  
    
    
    <link href="//fonts.googleapis.com/css?family=Lato:300,300italic,400,400italic,700,700italic&subset=latin,latin-ext" rel="stylesheet" type="text/css">
  






<link href="/lib/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css" />

<link href="/css/main.css?v=5.1.0" rel="stylesheet" type="text/css" />


  <meta name="keywords" content="jenkins,docker,mesos,DCOS,marathon-lb," />








  <link rel="shortcut icon" type="image/x-icon" href="/favicon.ico?v=5.1.0" />






<meta name="description" content="在DCOS中管理和使用镜像的方式有多种，各有优劣。但是，在DCOS集群内部维护一个私有容器仓库仍然是值得推荐的。它有两个主要优势：

它仅限于你的DCOS集群范围内，安全可控。

DCOS集群对容器镜像依赖较重且镜像文件都比较大，可以节省带宽，减少镜像拉取和推送的时间，加快部署速度。">
<meta property="og:type" content="article">
<meta property="og:title" content="在DCOS中搭建私有容器仓库">
<meta property="og:url" content="http://chrisrc.me/2016/11/17/mesos-docker-registry/index.html">
<meta property="og:site_name" content="山中，山外与俯瞰">
<meta property="og:description" content="在DCOS中管理和使用镜像的方式有多种，各有优劣。但是，在DCOS集群内部维护一个私有容器仓库仍然是值得推荐的。它有两个主要优势：

它仅限于你的DCOS集群范围内，安全可控。

DCOS集群对容器镜像依赖较重且镜像文件都比较大，可以节省带宽，减少镜像拉取和推送的时间，加快部署速度。">
<meta property="og:updated_time" content="2016-12-17T07:16:00.000Z">
<meta name="twitter:card" content="summary">
<meta name="twitter:title" content="在DCOS中搭建私有容器仓库">
<meta name="twitter:description" content="在DCOS中管理和使用镜像的方式有多种，各有优劣。但是，在DCOS集群内部维护一个私有容器仓库仍然是值得推荐的。它有两个主要优势：

它仅限于你的DCOS集群范围内，安全可控。

DCOS集群对容器镜像依赖较重且镜像文件都比较大，可以节省带宽，减少镜像拉取和推送的时间，加快部署速度。">



<script type="text/javascript" id="hexo.configurations">
  var NexT = window.NexT || {};
  var CONFIG = {
    root: '/',
    scheme: 'Mist',
    sidebar: {"position":"left","display":"post"},
    fancybox: true,
    motion: true,
    duoshuo: {
      userId: '0',
      author: '博主'
    },
    algolia: {
      applicationID: '',
      apiKey: '',
      indexName: '',
      hits: {"per_page":10},
      labels: {"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}
    }
  };
</script>



  <link rel="canonical" href="http://chrisrc.me/2016/11/17/mesos-docker-registry/"/>





  <title> 在DCOS中搭建私有容器仓库 | 山中，山外与俯瞰 </title>
</head>

<body itemscope itemtype="http://schema.org/WebPage" lang="zh-Hans">

  










  
  
    
  

  <div class="container one-collumn sidebar-position-left page-post-detail ">
    <div class="headband"></div>

    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-meta ">
  

  <div class="custom-logo-site-title">
    <a href="/"  class="brand" rel="start">
      <span class="logo-line-before"><i></i></span>
      <span class="site-title">山中，山外与俯瞰</span>
      <span class="logo-line-after"><i></i></span>
    </a>
  </div>
  <p class="site-subtitle">一次永不停止的探索之旅</p>
</div>

<div class="site-nav-toggle">
  <button>
    <span class="btn-bar"></span>
    <span class="btn-bar"></span>
    <span class="btn-bar"></span>
  </button>
</div>

<nav class="site-nav">
  

  
    <ul id="menu" class="menu">
      
        
        <li class="menu-item menu-item-home">
          <a href="/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-home"></i> <br />
            
            首页
          </a>
        </li>
      
        
        <li class="menu-item menu-item-dcos">
          <a href="/dcos" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-book"></i> <br />
            
            DC/OS
          </a>
        </li>
      
        
        <li class="menu-item menu-item-categories">
          <a href="/categories" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-th"></i> <br />
            
            分类
          </a>
        </li>
      
        
        <li class="menu-item menu-item-about">
          <a href="/about" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-user"></i> <br />
            
            关于
          </a>
        </li>
      
        
        <li class="menu-item menu-item-archives">
          <a href="/archives" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-archive"></i> <br />
            
            归档
          </a>
        </li>
      
        
        <li class="menu-item menu-item-tags">
          <a href="/tags" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-tags"></i> <br />
            
            标签
          </a>
        </li>
      

      
        <li class="menu-item menu-item-search">
          
            <a href="javascript:;" class="st-search-show-outputs">
          
            
              <i class="menu-item-icon fa fa-search fa-fw"></i> <br />
            
            搜索
          </a>
        </li>
      
    </ul>
  

  
    <div class="site-search">
      
  <form class="site-search-form">
  <input type="text" id="st-search-input" class="st-search-input st-default-search-input" />
</form>

<script type="text/javascript">
  (function(w,d,t,u,n,s,e){w['SwiftypeObject']=n;w[n]=w[n]||function(){
    (w[n].q=w[n].q||[]).push(arguments);};s=d.createElement(t);
    e=d.getElementsByTagName(t)[0];s.async=1;s.src=u;e.parentNode.insertBefore(s,e);
  })(window,document,'script','//s.swiftypecdn.com/install/v2/st.js','_st');

  _st('install', 'R9GcmhBwxpsAGLNCsquZ','2.0.0');
</script>



    </div>
  
</nav>



 </div>
    </header>

    <main id="main" class="main">
      <div class="main-inner">
        <div class="content-wrap">
          <div id="content" class="content">
            

  <div id="posts" class="posts-expand">
    

  

  
  
  

  <article class="post post-type-normal " itemscope itemtype="http://schema.org/Article">
  <link itemprop="mainEntityOfPage" href="http://chrisrc.me/2016/11/17/mesos-docker-registry/">

  <span style="display:none" itemprop="author" itemscope itemtype="http://schema.org/Person">
    <meta itemprop="name" content="chrisrc">
    <meta itemprop="description" content="">
    <meta itemprop="image" content="/images/avatar.gif">
  </span>

  <span style="display:none" itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
    <meta itemprop="name" content="山中，山外与俯瞰">
    <span style="display:none" itemprop="logo" itemscope itemtype="http://schema.org/ImageObject">
      <img style="display:none;" itemprop="url image" alt="山中，山外与俯瞰" src="">
    </span>
  </span>

    
      <header class="post-header">

        
        
          <h1 class="post-title" itemprop="name headline">
            
            
              
                在DCOS中搭建私有容器仓库
              
            
          </h1>
        

        <div class="post-meta">
          <span class="post-time">
            
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>
              <time title="Post created" itemprop="dateCreated datePublished" datetime="2016-11-17T16:10:18+08:00">
                2016-11-17
              </time>
            

            

            
          </span>

          
            <span class="post-category" >
              <span class="post-meta-divider">|</span>
              <span class="post-meta-item-icon">
                <i class="fa fa-folder-o"></i>
              </span>
              <span class="post-meta-item-text">分类于</span>
              
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
                  <a href="/categories/DC-OS/" itemprop="url" rel="index">
                    <span itemprop="name">DC/OS</span>
                  </a>
                </span>

                
                
              
            </span>
          

          
            
              <span class="post-comments-count">
                <span class="post-meta-divider">|</span>
                <a href="/2016/11/17/mesos-docker-registry/#comments" itemprop="discussionUrl">
                  <span class="post-comments-count ds-thread-count" data-thread-key="2016/11/17/mesos-docker-registry/" itemprop="commentCount"></span>
                </a>
              </span>
            
          

          

          
          

          

          

        </div>
      </header>
    


    <div class="post-body" itemprop="articleBody">

      
      

      
        <p>在DCOS中管理和使用镜像的方式有多种，各有优劣。但是，在DCOS集群内部维护一个私有容器仓库仍然是值得推荐的。它有两个主要优势：</p>
<ul>
<li><p>它仅限于你的DCOS集群范围内，安全可控。</p>
</li>
<li><p>DCOS集群对容器镜像依赖较重且镜像文件都比较大，可以节省带宽，减少镜像拉取和推送的时间，加快部署速度。</p>
<a id="more"></a>
<h2 id="私有容器仓库的选择"><a href="#私有容器仓库的选择" class="headerlink" title="私有容器仓库的选择"></a>私有容器仓库的选择</h2></li>
</ul>
<p>从容器仓库的实现产品来讲，当前支持容器仓库的产品包括：</p>
<ul>
<li><p>Docker Trusted Registry（Docker）</p>
</li>
<li><p>Registry（Docker）</p>
</li>
<li><p>Artifactory</p>
</li>
<li><p>Gitlab</p>
</li>
<li><p>Nexus3</p>
</li>
</ul>
<p>从安全角度，因Docker守护程序默认强制要求仓库处于可信的环境，在具体实践时，根据环境的可信度，通常有三种方案：</p>
<ul>
<li><p>可信证书颁发机构</p>
</li>
<li><p>自签名证书</p>
</li>
<li><p>非安全</p>
</li>
</ul>
<p>容器仓库服务作为DCOS集群内部的一个服务，必须很容易的供内部访问，同时也可能面临来自部分集群外部的访问（如推送部分外部基础镜像到容器仓库）。在DCOS中，服务命名与发现策略有：</p>
<ul>
<li><p>Mesos-DNS</p>
</li>
<li><p>Layer 4 Load Balancer</p>
</li>
<li><p>Marathon-LB</p>
</li>
</ul>
<p>本方案的选择充分结合DCOS集群的特性，采用Docker官方提供的Registry镜像，自签名证书和VIPs + Marathon-LB的方式。</p>
<h2 id="主要搭建步骤"><a href="#主要搭建步骤" class="headerlink" title="主要搭建步骤"></a>主要搭建步骤</h2><ol>
<li><p>集群环境准备。</p>
</li>
<li><p>创建具有正确的公用名和主题备用名的自签名证书。</p>
</li>
<li><p>使用证书的公钥和私钥配置Docker Registry服务。</p>
</li>
<li><p>在所有Agent节点上配置Docker守护程序以信任自签名证书。</p>
</li>
<li><p>部署Docker Registry服务。</p>
</li>
<li><p>在集群内部使用容器仓库。</p>
</li>
<li><p>在集群外部访问容器仓库。</p>
</li>
</ol>
<h2 id="集群环境准备"><a href="#集群环境准备" class="headerlink" title="集群环境准备"></a>集群环境准备</h2><p>为便于后续命令可以同时在所有Agent节点上执行，可根据自己熟悉的方法构建一个运维节点到所有Agent节点之间的可信任的SSH连接。一种方法可参考<a href="https://dcos.io/docs/1.9/administration/access-node/sshcluster/" target="_blank" rel="external">SSHing into Nodes</a>，也可以选择在一台Master上配置公私钥并将公钥添加到所有Agent节点的authorized_keys列表中。</p>
<p>使用下述配置调整Layer 4负载均衡（放弃对TCP状态的途中检测），让所有节点都能够从Registry中拉取和推送镜像。</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line"></div><div class="line">for i in $(curl -sS master.mesos:5050/slaves | jq &apos;.slaves[] | .hostname&apos; | tr -d &apos;&quot;&apos;); do ssh &quot;$i&quot; -oStrictHostKeyChecking=no &quot;sudo sysctl -w net.netfilter.nf_conntrack_tcp_be_liberal=1&quot;; done</div></pre></td></tr></table></figure>
<h2 id="使用自签名证书搭建私有容器仓库"><a href="#使用自签名证书搭建私有容器仓库" class="headerlink" title="使用自签名证书搭建私有容器仓库"></a>使用自签名证书搭建私有容器仓库</h2><h3 id="创建自签名证书"><a href="#创建自签名证书" class="headerlink" title="创建自签名证书"></a>创建自签名证书</h3><p>确保创建自签名证书的主机上安装了OpenSSL（本例使用DCOS集群中的一个Master节点，OpenSSL位于<code>/opt/mesosphere/packages/openssl--8042860cf76ca9ef965af9ee6d59acace266356e</code>。</p>
<p>创建一个<code>certs</code>目录：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div></pre></td><td class="code"><pre><div class="line"></div><div class="line">cd ~</div><div class="line"></div><div class="line">mkdir  certs</div><div class="line"></div><div class="line">cd certs</div><div class="line"></div><div class="line">cp /opt/mesosphere/packages/openssl--8042860cf76ca9ef965af9ee6d59acace266356e/etc/ssl/openssl.cnf ./openssl.cnf</div><div class="line"></div><div class="line">sed -i &quot;/\[ v3_ca \]/a subjectAltName = IP:192.168.0.1&quot; ./openssl.cnf</div><div class="line"></div><div class="line">openssl req -config ./openssl.cnf -newkey rsa:2048 -nodes -keyout domain.key -x509 -days 365 -out domain.crt -subj &quot;/C=CN/ST=SH/L=Shang Hai/O=example.com/CN=192.168.0.1&quot;</div></pre></td></tr></table></figure>
<p>使用与Docker配合工作的VIP创建自签名证书有点复杂，因为必须要修改OpenSSL的配置以将VIP包含在证书的主题备用名称中。</p>
<p><strong>注1：</strong>此处IP“192.168.0.1”为<strong>虚拟</strong>IP，仅在DCOS集群内部可见，因此可以根据需要使用任意自定义的IP地址。该配置对应的Marathon JSON定义请参考本章后续小节。</p>
<p><strong>注2：</strong>除了直接使用VIP，还可以使用服务的Mesos-DNS名称或引用第4层负载均衡VIP的名称创建证书。</p>
<p>使用Mesos DNS：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line"></div><div class="line">openssl req -config ./openssl.cnf -newkey rsa:2048 -nodes -keyout domain.key -x509 -days 365 -out domain.crt -subj &quot;/C=CN/ST=SH/L=Shang Hai/O=example.com/CN=registry.marathon.mesos&quot;</div></pre></td></tr></table></figure>
<p>使用引用VIP的主机名：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line"></div><div class="line">openssl req -config ./openssl.cnf -newkey rsa:2048 -nodes -keyout domain.key -x509 -days 365 -out domain.crt -subj &quot;/C=CN/ST=SH/L=Shang Hai/O=example.com/CN=registry.example.com&quot;</div></pre></td></tr></table></figure>
<h3 id="拷贝证书和私钥到所有Agent节点"><a href="#拷贝证书和私钥到所有Agent节点" class="headerlink" title="拷贝证书和私钥到所有Agent节点"></a>拷贝证书和私钥到所有Agent节点</h3><p>使用下述命令将证书和私钥拷贝到集群所有Agent节点。注意，下述命令仅适用于从DCOS集群的Master节点中的当前Leader节点进行操作。</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div></pre></td><td class="code"><pre><div class="line"></div><div class="line">MESOS_AGENTS=$(curl -sS master.mesos:5050/slaves | jq &apos;.slaves[] | .hostname&apos; | tr -d &apos;&quot;&apos;); </div><div class="line"></div><div class="line">for i in $MESOS_AGENTS; do ssh &quot;$i&quot; -oStrictHostKeyChecking=no &quot;sudo mkdir --parent /etc/privateregistry/certs/&quot;; done </div><div class="line"></div><div class="line">for i in $MESOS_AGENTS; do scp -o StrictHostKeyChecking=no ./domain.* &quot;$i&quot;:~/; done </div><div class="line"></div><div class="line">for i in $MESOS_AGENTS; do ssh &quot;$i&quot; -oStrictHostKeyChecking=no &quot;sudo mv ./domain.* /etc/privateregistry/certs/&quot;; done</div></pre></td></tr></table></figure>
<p>配置所有Agent节点上的Docker守护程序信任为私有容器仓库创建的自签名证书。</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div></pre></td><td class="code"><pre><div class="line"></div><div class="line">MESOS_AGENTS=$(curl -sS master.mesos:5050/slaves | jq &apos;.slaves[] | .hostname&apos; | tr -d &apos;&quot;&apos;);</div><div class="line"></div><div class="line">for i in $MESOS_AGENTS; do ssh &quot;$i&quot; -oStrictHostKeyChecking=no &quot;sudo mkdir --parent /etc/docker/certs.d/192.168.0.1&quot;; done </div><div class="line"></div><div class="line">for i in $MESOS_AGENTS; do ssh &quot;$i&quot; -oStrictHostKeyChecking=no &quot;sudo cp /etc/privateregistry/certs/domain.crt /etc/docker/certs.d/192.168.0.1/ca.crt&quot;; done </div><div class="line"></div><div class="line">for i in $MESOS_AGENTS; do ssh &quot;$i&quot; -oStrictHostKeyChecking=no &quot;sudo systemctl restart docker&quot;; done</div></pre></td></tr></table></figure>
<p><strong>注1：</strong>上述命令重启Docker引擎服务时会导致当前正在运行的容器服务重启。</p>
<p><strong>注2：</strong>对于Docker in Docker（DnD），可以将容器的<code>/etc/docker/certs.d</code>映射到Agent节点宿主机的相同路径。</p>
<h3 id="部署Registry到DCOS集群"><a href="#部署Registry到DCOS集群" class="headerlink" title="部署Registry到DCOS集群"></a>部署Registry到DCOS集群</h3><figure class="highlight json"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div><div class="line">24</div><div class="line">25</div><div class="line">26</div><div class="line">27</div><div class="line">28</div><div class="line">29</div><div class="line">30</div><div class="line">31</div><div class="line">32</div><div class="line">33</div><div class="line">34</div><div class="line">35</div><div class="line">36</div><div class="line">37</div><div class="line">38</div><div class="line">39</div><div class="line">40</div><div class="line">41</div><div class="line">42</div><div class="line">43</div><div class="line">44</div><div class="line">45</div><div class="line">46</div><div class="line">47</div><div class="line">48</div><div class="line">49</div><div class="line">50</div><div class="line">51</div><div class="line">52</div><div class="line">53</div><div class="line">54</div><div class="line">55</div><div class="line">56</div><div class="line">57</div><div class="line">58</div></pre></td><td class="code"><pre><div class="line"></div><div class="line">&#123; </div><div class="line"></div><div class="line">    <span class="attr">"id"</span>: <span class="string">"/registry"</span>, <span class="attr">"cpus"</span>: <span class="number">0.5</span>, <span class="attr">"mem"</span>: <span class="number">128</span>, <span class="attr">"disk"</span>: <span class="number">0</span>, <span class="attr">"instances"</span>: <span class="number">1</span>, </div><div class="line"></div><div class="line">    <span class="attr">"constraints"</span>: [[<span class="string">"hostname"</span>,<span class="string">"LIKE"</span>,<span class="string">"192.168.1.80"</span>]], </div><div class="line"></div><div class="line">    <span class="attr">"coainer"</span>: &#123; </div><div class="line"></div><div class="line">        <span class="attr">"docker"</span>: &#123; </div><div class="line"></div><div class="line">            <span class="attr">"image"</span>: <span class="string">"registry"</span>, <span class="attr">"forcePullImage"</span>: <span class="literal">false</span>, <span class="attr">"privileged"</span>: <span class="literal">false</span>, </div><div class="line"></div><div class="line">            <span class="attr">"portMappings"</span>: [ &#123; </div><div class="line"></div><div class="line">                <span class="attr">"containerPort"</span>: <span class="number">5000</span>, <span class="attr">"protocol"</span>: <span class="string">"tcp"</span>, <span class="attr">"servicePort"</span>: <span class="number">5000</span>, </div><div class="line"></div><div class="line">                <span class="attr">"labels"</span>: &#123; <span class="attr">"VIP_0"</span>: <span class="string">"192.168.0.1:443"</span> &#125; </div><div class="line"></div><div class="line">            &#125; ], </div><div class="line"></div><div class="line">            <span class="attr">"network"</span>: <span class="string">"BRIDGE"</span> </div><div class="line"></div><div class="line">        &#125;, </div><div class="line"></div><div class="line">        <span class="attr">"type"</span>: <span class="string">"DOCKER"</span>, </div><div class="line"></div><div class="line">        <span class="attr">"volumes"</span>: [ </div><div class="line"></div><div class="line">            &#123; <span class="attr">"containerPath"</span>: <span class="string">"/certs/"</span>, <span class="attr">"hostPath"</span>: <span class="string">"/etc/privateregistry/certs/"</span>, <span class="attr">"mode"</span>: <span class="string">"RO"</span> &#125;, </div><div class="line"></div><div class="line">            &#123; <span class="attr">"containerPath"</span>: <span class="string">"/var/lib/registry"</span>, <span class="attr">"hostPath"</span>: <span class="string">"/data/docker-registry"</span>, <span class="attr">"mode"</span>: <span class="string">"RW"</span> &#125; </div><div class="line"></div><div class="line">        ] </div><div class="line"></div><div class="line">    &#125;, </div><div class="line"></div><div class="line">    <span class="attr">"portDefinitions"</span>: [ &#123; <span class="attr">"port"</span>: <span class="number">5000</span>, <span class="attr">"protocol"</span>: <span class="string">"tcp"</span>, <span class="attr">"labels"</span>: &#123;&#125; &#125; ], </div><div class="line"></div><div class="line">    <span class="attr">"healthChecks"</span>: [ </div><div class="line"></div><div class="line">        &#123; <span class="attr">"protocol"</span>: <span class="string">"TCP"</span>, <span class="attr">"portIndex"</span>: <span class="number">0</span>, <span class="attr">"gracePeriodSeconds"</span>: <span class="number">60</span>, <span class="attr">"intervalSeconds"</span>: <span class="number">60</span>, <span class="attr">"timeoutSeconds"</span>: <span class="number">20</span>, <span class="attr">"maxConsecutiveFailures"</span>: <span class="number">3</span>&#125; </div><div class="line"></div><div class="line">    ], </div><div class="line"></div><div class="line">    <span class="attr">"labels"</span>: &#123;<span class="attr">"HAPROXY_GROUP"</span>: <span class="string">"external"</span>&#125;, </div><div class="line"></div><div class="line">    <span class="attr">"env"</span>: &#123; </div><div class="line"></div><div class="line">        <span class="attr">"REGISTRY_HTTP_TLS_CERTIFICATE"</span>: <span class="string">"/certs/domain.crt"</span>, </div><div class="line"></div><div class="line">        <span class="attr">"REGISTRY_HTTP_TLS_KEY"</span>: <span class="string">"/certs/domain.key"</span>, </div><div class="line"></div><div class="line">        <span class="attr">"REGISTRY_HTTP_SECRET"</span>: <span class="string">"123456secret"</span> </div><div class="line"></div><div class="line">    &#125;</div><div class="line"></div><div class="line">&#125;</div></pre></td></tr></table></figure>
<p>将上述Marathon APP的JSON定义保存到一个JSON文件（如<code>docker-registry.json</code>），通过调用DCOS的WEB API或者通过DCOS CLI将服务部署到DCOS集群。</p>
<p>WEB API</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line"></div><div class="line">curl -i -H &quot;Content-type: application/json&quot; -X POST http://192.168.1.69:8080/v2/apps --data @docker-registry.json</div></pre></td></tr></table></figure>
<p>或 CLI</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line"></div><div class="line">dcos marathon app add docker-registry.json</div></pre></td></tr></table></figure>
<h2 id="在集群内部访问容器仓库"><a href="#在集群内部访问容器仓库" class="headerlink" title="在集群内部访问容器仓库"></a>在集群内部访问容器仓库</h2><p>如果前述私有容器仓库搭建过程中采用的是VIP模式，则在集群内部访问容器仓库时，需要使用VIP：“192.168.0.1”。</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line"></div><div class="line">curl -k https://192.168.0.1/v2/_catalog</div></pre></td></tr></table></figure>
<p>在Dockerfile中设置基础镜像时，也需要进行调整：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line"></div><div class="line">FROM 192.168.0.1/base/docker-tomcat-base</div></pre></td></tr></table></figure>
<p>另外，除了前述提到的DnD需要映射主机的<code>/etc/docker/certs.d</code>来使用私有容器的签名证书外，对于一些由服务动态创建的容器也需要添加映射配置，如Jenkins动态创建的Slave容器主机。否则，可能会碰到类似<code>x509: certificate signed by unknown authority</code>的异常。</p>
<h2 id="在集群外部访问容器仓库"><a href="#在集群外部访问容器仓库" class="headerlink" title="在集群外部访问容器仓库"></a>在集群外部访问容器仓库</h2><p>因为DCOS集群内部使用VIP“192.168.0.1”来访问容器仓库，VIP“192.168.0.1”对集群外部环境来说是无法访问的，那么集群外部如何访问该私有容器仓库？</p>
<p>从集群外部访问容器仓库有两种途径。</p>
<p>第一种方案：注意到前述Registry的JSON定义中，我们为APP设置了值为<strong>5000</strong>的<code>servicePort</code>并且添加了<code>HAPROXY_GROUP</code>标签，如果DCOS集群中在<strong>Public</strong> Agent节点上部署了Marathon-LB服务，则可以通过MLB访问容器仓库。</p>
<p>假设Public Agent节点的IP地址为192.168.1.50，则</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line"></div><div class="line">curl -k https://192.168.1.50:5000/v2/_catalog</div></pre></td></tr></table></figure>
<p>可以向仓库推送容器镜像：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line"></div><div class="line">docker push 192.168.1.50:5000/base/docker-tomcat-base</div></pre></td></tr></table></figure>
<p>在Dockerfile中设置基础镜像时，同样需要进行调整：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line"></div><div class="line">FROM 192.168.1.50：5000/base/docker-tomcat-base</div></pre></td></tr></table></figure>
<p>第二种方案是为部署的Registry服务设置固定的hostPort（如5000），并固定到一个Agent节点（如：192.168.1.70）上，则可以用与MLB方案相同的方式访问容器仓库。</p>
<p>推荐使用MLB方案。</p>
<h2 id="参考"><a href="#参考" class="headerlink" title="参考"></a>参考</h2><p><a href="https://dcos.io/docs/1.9/usage/tutorials/registry/" target="_blank" rel="external">https://dcos.io/docs/1.9/usage/tutorials/registry/</a></p>

      
    </div>

    <div>
      
        

      
    </div>

    <div>
      
        

      
    </div>


    <footer class="post-footer">
      
        <div class="post-tags">
          
            <a href="/tags/jenkins/" rel="tag"># jenkins</a>
          
            <a href="/tags/docker/" rel="tag"># docker</a>
          
            <a href="/tags/mesos/" rel="tag"># mesos</a>
          
            <a href="/tags/DCOS/" rel="tag"># DCOS</a>
          
            <a href="/tags/marathon-lb/" rel="tag"># marathon-lb</a>
          
        </div>
      

      
        <div class="post-nav">
          <div class="post-nav-next post-nav-item">
            
              <a href="/2016/10/29/js-module-history/" rel="next" title="JavaScript 模块简史(转载)">
                <i class="fa fa-chevron-left"></i> JavaScript 模块简史(转载)
              </a>
            
          </div>

          <span class="post-nav-divider"></span>

          <div class="post-nav-prev post-nav-item">
            
              <a href="/2016/11/28/dcos-book-step-by-step/" rel="prev" title="DC/OS修炼之路">
                DC/OS修炼之路 <i class="fa fa-chevron-right"></i>
              </a>
            
          </div>
        </div>
      

      
      
    </footer>
  </article>



    <div class="post-spread">
      
        <div class="ds-share flat" data-thread-key="2016/11/17/mesos-docker-registry/"
     data-title="在DCOS中搭建私有容器仓库"
     data-content=""
     data-url="http://chrisrc.me/2016/11/17/mesos-docker-registry/">
  <div class="ds-share-inline">
    <ul  class="ds-share-icons-16">

      <li data-toggle="ds-share-icons-more"><a class="ds-more" href="javascript:void(0);">分享到：</a></li>
      <li><a class="ds-weibo" href="javascript:void(0);" data-service="weibo">微博</a></li>
      <li><a class="ds-qzone" href="javascript:void(0);" data-service="qzone">QQ空间</a></li>
      <li><a class="ds-qqt" href="javascript:void(0);" data-service="qqt">腾讯微博</a></li>
      <li><a class="ds-wechat" href="javascript:void(0);" data-service="wechat">微信</a></li>

    </ul>
    <div class="ds-share-icons-more">
    </div>
  </div>
</div>
      
    </div>
  </div>


          </div>
          


          
  <div class="comments" id="comments">
    
      <div class="ds-thread" data-thread-key="2016/11/17/mesos-docker-registry/"
           data-title="在DCOS中搭建私有容器仓库" data-url="http://chrisrc.me/2016/11/17/mesos-docker-registry/">
      </div>
    
  </div>


        </div>
        
          
  
  <div class="sidebar-toggle">
    <div class="sidebar-toggle-line-wrap">
      <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
      <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
      <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
    </div>
  </div>

  <aside id="sidebar" class="sidebar">
    <div class="sidebar-inner">

      

      
        <ul class="sidebar-nav motion-element">
          <li class="sidebar-nav-toc sidebar-nav-active" data-target="post-toc-wrap" >
            文章目录
          </li>
          <li class="sidebar-nav-overview" data-target="site-overview">
            站点概览
          </li>
        </ul>
      

      <section class="site-overview sidebar-panel">
        <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
          <img class="site-author-image" itemprop="image"
               src="/images/avatar.gif"
               alt="chrisrc" />
          <p class="site-author-name" itemprop="name">chrisrc</p>
          <p class="site-description motion-element" itemprop="description"></p>
        </div>
        <nav class="site-state motion-element">
          <div class="site-state-item site-state-posts">
            <a href="/archives">
              <span class="site-state-item-count">69</span>
              <span class="site-state-item-name">日志</span>
            </a>
          </div>

          
            <div class="site-state-item site-state-categories">
              <a href="/categories">
                <span class="site-state-item-count">21</span>
                <span class="site-state-item-name">分类</span>
              </a>
            </div>
          

          
            <div class="site-state-item site-state-tags">
              <a href="/tags">
                <span class="site-state-item-count">162</span>
                <span class="site-state-item-name">标签</span>
              </a>
            </div>
          

        </nav>

        

        <div class="links-of-author motion-element">
          
            
              <span class="links-of-author-item">
                <a href="https://github.com/christtrc" target="_blank" title="GitHub">
                  
                    <i class="fa fa-fw fa-github"></i>
                  
                  GitHub
                </a>
              </span>
            
              <span class="links-of-author-item">
                <a href="https://twitter.com/chrisrc" target="_blank" title="Twitter">
                  
                    <i class="fa fa-fw fa-twitter"></i>
                  
                  Twitter
                </a>
              </span>
            
          
        </div>

        
        
          <div class="cc-license motion-element" itemprop="license">
            <a href="https://creativecommons.org/licenses/by-nc-sa/4.0/" class="cc-opacity" target="_blank">
              <img src="/images/cc-by-nc-sa.svg" alt="Creative Commons" />
            </a>
          </div>
        

        
        

        


      </section>

      
      <!--noindex-->
        <section class="post-toc-wrap motion-element sidebar-panel sidebar-panel-active">
          <div class="post-toc">

            
              
            

            
              <div class="post-toc-content"><ol class="nav"><li class="nav-item nav-level-2"><a class="nav-link" href="#私有容器仓库的选择"><span class="nav-number">1.</span> <span class="nav-text">私有容器仓库的选择</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#主要搭建步骤"><span class="nav-number">2.</span> <span class="nav-text">主要搭建步骤</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#集群环境准备"><span class="nav-number">3.</span> <span class="nav-text">集群环境准备</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#使用自签名证书搭建私有容器仓库"><span class="nav-number">4.</span> <span class="nav-text">使用自签名证书搭建私有容器仓库</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#创建自签名证书"><span class="nav-number">4.1.</span> <span class="nav-text">创建自签名证书</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#拷贝证书和私钥到所有Agent节点"><span class="nav-number">4.2.</span> <span class="nav-text">拷贝证书和私钥到所有Agent节点</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#部署Registry到DCOS集群"><span class="nav-number">4.3.</span> <span class="nav-text">部署Registry到DCOS集群</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#在集群内部访问容器仓库"><span class="nav-number">5.</span> <span class="nav-text">在集群内部访问容器仓库</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#在集群外部访问容器仓库"><span class="nav-number">6.</span> <span class="nav-text">在集群外部访问容器仓库</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#参考"><span class="nav-number">7.</span> <span class="nav-text">参考</span></a></li></ol></div>
            

          </div>
        </section>
      <!--/noindex-->
      

    </div>
  </aside>


        
      </div>
    </main>

    <footer id="footer" class="footer">
      <div class="footer-inner">
        <div class="copyright" >
  
  &copy;  2015 - 
  <span itemprop="copyrightYear">2017</span>
  <span class="with-love">
    <i class="fa fa-heart"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">
     
      <a href="mailto:chrisrc@qq.com">chrisrc</a> 
    
  </span>
  <span class="author"> &nbsp; QQ: 58122705 </span>
</div>


<div class="powered-by">
  由 <a class="theme-link" href="https://hexo.io">Hexo</a> 强力驱动
</div>

<div class="theme-info">
  主题 -
  <a class="theme-link" href="https://github.com/iissnan/hexo-theme-next">
    NexT.Mist
  </a>
</div>


        

        
      </div>
    </footer>

    <div class="back-to-top">
      <i class="fa fa-arrow-up"></i>
    </div>
  </div>

  

<script type="text/javascript">
  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
    window.Promise = null;
  }
</script>









  



  
  <script type="text/javascript" src="/lib/jquery/index.js?v=2.1.3"></script>

  
  <script type="text/javascript" src="/lib/fastclick/lib/fastclick.min.js?v=1.0.6"></script>

  
  <script type="text/javascript" src="/lib/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>

  
  <script type="text/javascript" src="/lib/velocity/velocity.min.js?v=1.2.1"></script>

  
  <script type="text/javascript" src="/lib/velocity/velocity.ui.min.js?v=1.2.1"></script>

  
  <script type="text/javascript" src="/lib/fancybox/source/jquery.fancybox.pack.js?v=2.1.5"></script>


  


  <script type="text/javascript" src="/js/src/utils.js?v=5.1.0"></script>

  <script type="text/javascript" src="/js/src/motion.js?v=5.1.0"></script>



  
  

  
  <script type="text/javascript" src="/js/src/scrollspy.js?v=5.1.0"></script>
<script type="text/javascript" src="/js/src/post-details.js?v=5.1.0"></script>



  


  <script type="text/javascript" src="/js/src/bootstrap.js?v=5.1.0"></script>



  

  
    
  

  <script type="text/javascript">
    var duoshuoQuery = {short_name:"chrisrc"};
    (function() {
      var ds = document.createElement('script');
      ds.type = 'text/javascript';ds.async = true;
      ds.id = 'duoshuo-script';
      ds.src = (document.location.protocol == 'https:' ? 'https:' : 'http:') + '//static.duoshuo.com/embed.js';
      ds.charset = 'UTF-8';
      (document.getElementsByTagName('head')[0]
      || document.getElementsByTagName('body')[0]).appendChild(ds);
    })();
  </script>

  
    
    
    <script src="/lib/ua-parser-js/dist/ua-parser.min.js?v=0.7.9"></script>
    <script src="/js/src/hook-duoshuo.js"></script>
  








  
  

  

  

  
<script>
(function(){
    var bp = document.createElement('script');
    var curProtocol = window.location.protocol.split(':')[0];
    if (curProtocol === 'https') {
        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';        
    }
    else {
        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
    }
    var s = document.getElementsByTagName("script")[0];
    s.parentNode.insertBefore(bp, s);
})();
</script>


  
<script>
(function(){
   var src = (document.location.protocol == "http:") ? "http://js.passport.qihucdn.com/11.0.1.js?ed903ab05fbc5fa64d95e4bfbf3d3a04":"https://jspassport.ssl.qhimg.com/11.0.1.js?ed903ab05fbc5fa64d95e4bfbf3d3a04";
   document.write('<script src="' + src + '" id="sozz"><\/script>');
})();
</script>

  


</body>
</html>
